[ANN] Firo (FIRO) - Implementing ZKP privacy without trusted setup

[AND01]

Zcoin speed is a little slow
 3300 tps is so far the record made by bitshares, but thats absolutely hightech with 3 seconds blocks

[Jazek]

Well I switched to suprnova again with my 1.4Mhs/s, i mined for 24h in miningpoolhub and i get the same coins so... i wont help this centralization as i get the same coins

[volyova]

https://zcoin.io/zcoin-moving-beyond-trusted-setup-in-zerocoin/

[zcoinofficial]

Zcoin moving beyond trusted setup in Zerocoin

What is a Trusted Setup?

Zero knowledge setups offer amazing anonymity with anonymity sets exceeding thousands compared to previous anonymity schemes that typically only offer a dozen or so. One of the primary criticisms of Zerocoin and other zero knowledge coins like Zcash is that it requires a ‘trusted setup‘ phase. A trusted setup means you need to trust someone to generate some initial parameters and then destroy those parameters.

A way to visualize it would be akin to making a lock and then trusting that person to destroy the only key to it. It is however not easy to prove that the key was destroyed, for e.g. in our example scenario, was a duplicate made somewhere? Or a photo taken of the key before it was destroyed? The same type of problems exist when trying to prove that the initial parameters were permanently destroyed and not known by anyone.

The consequences of having the initial parameters leaked is that someone can generate coins out of thin air by doing forged Zerocoin spend transactions. In Zcoin, this is mitigated somewhat by having an auditable supply.

How is Trusted Setup implemented in Zcoin?

Zerocoin as implemented in Zcoin and in the original paper currently uses RSA accumulators which require the generation of two large prime numbers. We utilized the RSA-2048 parameters generated in 1991 from the RSA factoring challenge which was an academic challenge to learn about the difficulty of factoring large number and the parameters we used had a USD200,000 prize if someone managed to factor it. To this day, no one has claimed the prize or announced a successful factorization of RSA-2048 with the last publicly successful factorization at RSA-768.

Using the RSA factoring challenge parameters meant that you did not need to trust the Zcoin developers and only trust that the parameters from the RSA factoring challenge remained secure. For further reading on the RSA factoring challenge, you can read more here. However, we recognize that having a trusted setup is not ideal and it was always in our roadmap to implement a trustless setup. There has been previous attempts to remove the trusted setup in Zerocoin and the most well known one was the proposed use of RSA UFOs which thus far have been impractical to implement.

How Zcoin is removing the trusted setup

We are therefore very happy to announce that we believe we have found the answer in solving the trustless setup problem through the use of the Sigma protocol  in Zerocoin as detailed by Jens Groth and Markulf Kohlweiss from University College London and Microsoft Research.

In a nutshell, the Sigma (Σ) protocol does the following:

• No more trusted setup
• RSA accumulators are replaced with elliptic curve groups
• Reduction of Zerocoin proof sizes from 25 kb to around ~1kb allowing more Zerocoin transactions per block and making Zcoin much more scalable.
• Higher security using 256-bit elliptic curves roughly equivalent to 3072 bit RSA (currently we are using 2048 bit RSA)

We have also found the Sigma (Σ) protocol implemented in existing open source repositories greatly reducing the amount of work required to implement it in Zcoin. The Zcoin team will need to further examine its verification speed and computation time using the Sigma (Σ) protocol. We plan to implement the Sigma (Σ) protocol after MTP completion and Znodes. We are of the opinion that once Zcoin implements the Sigma (Σ) protocol, we would have a very compelling solution, offering the power and large anonymity sets of zero knowledge proofs with low proof size without having to trust anyone with the generation of initial parameters which is required in other zero knowledge setups such as in Zcash.

Update on MTP Development

We know many of you are eager to hear about how we are coming along with MTP since we released it on Zcoin’s testnet. MTP continues to be tested and the dev team has made good progress on it with no major hurdles encountered.

We are also testing various parameters to achieve a good balance between GPU and CPU performance while remaining ASIC resistant. We continue to work towards releasing MTP on mainnet as soon as possible along with GPU miners. It is promising to see so many top devs interested in the work we do and have received a lot of constructive feedback on it. We welcome anyone who wishes to work with us in improving MTP!

Once we have finalized the parameters, we will hold a competition  to develop MTP miners with attractive bounties to incentivize efficient open sourced miners to the public.

[zcoinofficial]

Thanks for your trust, you're right, the income is the same after time.

I've dropped the fee to 0% on suprnova in the hope that some folks might spread over some hash.

Yup Suprnova's pool is pretty stable and I believe they also now have an Asia Pacific node for our Chinese and Asian friends.

[Goruno]

Thanks for your trust, you're right, the income is the same after time.

I've dropped the fee to 0% on suprnova in the hope that some folks might spread over some hash.

Yup Suprnova's pool is pretty stable and I believe they also now have an Asia Pacific node for our Chinese and Asian friends.

When is the MTP  released ? I'm waiting for that news as I know it will be released in early April but until now I can not see anything about this action.
I'm still waiting for this news soon and this fact will not make us down. I need a certain time for official MTP lauching. Thanks.

[zcoinofficial]

Thanks for your trust, you're right, the income is the same after time.

I've dropped the fee to 0% on suprnova in the hope that some folks might spread over some hash.

Yup Suprnova's pool is pretty stable and I believe they also now have an Asia Pacific node for our Chinese and Asian friends.

When is the MTP  released ? I'm waiting for that news as I know it will be released in early April but until now I can not see anything about this action.
I'm still waiting for this news soon and this fact will not make us down. I need a certain time for official MTP lauching. Thanks.

MTP has already been released on testnet as promised in early April so it's running on Zcoin testnet and people are free to test it on the zcoin mtp branch.

We don't have an official time for releasing on mainnet as we want to make sure it is relatively bug free and achieves the purpose we want but all we can say is 'soon'. It's hard to give definite date for bug fixing and dev but will update as we go along.

[Mikkiun]

Zcoin moving beyond trusted setup in Zerocoin

What is a Trusted Setup?

Zero knowledge setups offer amazing anonymity with anonymity sets exceeding thousands compared to previous anonymity schemes that typically only offer a dozen or so. One of the primary criticisms of Zerocoin and other zero knowledge coins like Zcash is that it requires a ‘trusted setup‘ phase. A trusted setup means you need to trust someone to generate some initial parameters and then destroy those parameters.

A way to visualize it would be akin to making a lock and then trusting that person to destroy the only key to it. It is however not easy to prove that the key was destroyed, for e.g. in our example scenario, was a duplicate made somewhere? Or a photo taken of the key before it was destroyed? The same type of problems exist when trying to prove that the initial parameters were permanently destroyed and not known by anyone.

The consequences of having the initial parameters leaked is that someone can generate coins out of thin air by doing forged Zerocoin spend transactions. In Zcoin, this is mitigated somewhat by having an auditable supply.

How is Trusted Setup implemented in Zcoin?

Zerocoin as implemented in Zcoin and in the original paper currently uses RSA accumulators which require the generation of two large prime numbers. We utilized the RSA-2048 parameters generated in 1991 from the RSA factoring challenge which was an academic challenge to learn about the difficulty of factoring large number and the parameters we used had a USD200,000 prize if someone managed to factor it. To this day, no one has claimed the prize or announced a successful factorization of RSA-2048 with the last publicly successful factorization at RSA-768.

Using the RSA factoring challenge parameters meant that you did not need to trust the Zcoin developers and only trust that the parameters from the RSA factoring challenge remained secure. For further reading on the RSA factoring challenge, you can read more here. However, we recognize that having a trusted setup is not ideal and it was always in our roadmap to implement a trustless setup. There has been previous attempts to remove the trusted setup in Zerocoin and the most well known one was the proposed use of RSA UFOs which thus far have been impractical to implement.

How Zcoin is removing the trusted setup

We are therefore very happy to announce that we believe we have found the answer in solving the trustless setup problem through the use of the Sigma protocol  in Zerocoin as detailed by Jens Groth and Markulf Kohlweiss from University College London and Microsoft Research.

In a nutshell, the Sigma (Σ) protocol does the following:

• No more trusted setup
• RSA accumulators are replaced with elliptic curve groups
• Reduction of Zerocoin proof sizes from 25 kb to around ~1kb allowing more Zerocoin transactions per block and making Zcoin much more scalable.
• Higher security using 256-bit elliptic curves roughly equivalent to 3072 bit RSA (currently we are using 2048 bit RSA)

We have also found the Sigma (Σ) protocol implemented in existing open source repositories greatly reducing the amount of work required to implement it in Zcoin. The Zcoin team will need to further examine its verification speed and computation time using the Sigma (Σ) protocol. We plan to implement the Sigma (Σ) protocol after MTP completion and Znodes. We are of the opinion that once Zcoin implements the Sigma (Σ) protocol, we would have a very compelling solution, offering the power and large anonymity sets of zero knowledge proofs with low proof size without having to trust anyone with the generation of initial parameters which is required in other zero knowledge setups such as in Zcash.

Update on MTP Development

We know many of you are eager to hear about how we are coming along with MTP since we released it on Zcoin’s testnet. MTP continues to be tested and the dev team has made good progress on it with no major hurdles encountered.

We are also testing various parameters to achieve a good balance between GPU and CPU performance while remaining ASIC resistant. We continue to work towards releasing MTP on mainnet as soon as possible along with GPU miners. It is promising to see so many top devs interested in the work we do and have received a lot of constructive feedback on it. We welcome anyone who wishes to work with us in improving MTP!

Once we have finalized the parameters, we will hold a competition  to develop MTP miners with attractive bounties to incentivize efficient open sourced miners to the public.

It's good to hear this news updated and I'm waiting for some news updated from testing MTP soon . This algo is a special part of Zcoin project and it must be done to prove this potential technology. I hope Zcoin project will be hottest in this year after MTP algo released.

[ZenFr]

Well I switched to suprnova again with my 1.4Mhs/s, i mined for 24h in miningpoolhub and i get the same coins so... i wont help this centralization as i get the same coins

Really ?
In the last days ?
Can you explain how it is possible ?

Because I also switched beetween SuprNova and MiningPoolHub in the last 2 days and I earned 5 times more with poolmininghub than with suprnova !

And the explaination is here :
SuprNova : block 30671 -> (un)luck 504.85, more than 2 days to mine  (less than half a block in 24 hours).
PoolMiningHub : in 24 h, more than 70 blocks found, luck 98 %., earned 5 time more than SuprNova.

Theorically, in a very long period (in a infinite period), earning should be equal, but in reality, since 15 days, SuprNova is completely out : a very too big (un)luck : look at the stats on the site).

[Jazek]

Well I switched to suprnova again with my 1.4Mhs/s, i mined for 24h in miningpoolhub and i get the same coins so... i wont help this centralization as i get the same coins

Really ?
In the last days ?
Can you explain how it is possible ?

Because I also switched beetween SuprNova and MiningPoolHub in the last 2 days and I earned 5 times more with poolmininghub than with suprnova !

And the explaination is here :
SuprNova : block 30671 -> (un)luck 504.85, more than 2 days to mine  (less than half a block in 24 hours).
PoolMiningHub : in 24 h, more than 70 blocks found, luck 98 %., earned 5 time more than SuprNova.

Theorically, in a very long period (in a infinite period), earning should be equal, but in reality, since 15 days, SuprNova is completely out : a very too big (unluck : look at the stats on the site).

I took note of how much i was mining on suprnova days before, then i switched to miningpoolhub and i was getting the same maybe a bit more so...

Indeed i get 4-5 times more shares in suprnova compared to miningpoolhub

[ZenFr]

Well I switched to suprnova again with my 1.4Mhs/s, i mined for 24h in miningpoolhub and i get the same coins so... i wont help this centralization as i get the same coins

Really ?
In the last days ?
Can you explain how it is possible ?

Because I also switched beetween SuprNova and MiningPoolHub in the last 2 days and I earned 5 times more with poolmininghub than with suprnova !

And the explaination is here :
SuprNova : block 30671 -> (un)luck 504.85, more than 2 days to mine  (less than half a block in 24 hours).
PoolMiningHub : in 24 h, more than 70 blocks found, luck 98 %., earned 5 time more than SuprNova.

Theorically, in a very long period (in a infinite period), earning should be equal, but in reality, since 15 days, SuprNova is completely out : a very too big (unluck : look at the stats on the site).

I took note of how much i was mining on suprnova days before, then i switched to miningpoolhub and i was getting the same maybe a bit more so...

Indeed i get 4-5 times more shares in suprnova compared to miningpoolhub

You are a very very very lucky guy.
Is that possible to be so lucky ?

Say me what block on Suprnova and poolmininghub and the luck numbers.
Lasts block and luck on SuprNova :
 30,280 (april 17) -> luck 73.28
 30,390 -> luck 202,50
 30,405 -> luck 17 (good luck but not enough to make a normal average with the others blocks)
 30,671 -> luck 504.85
 30,712 -> luck 64,76
In the lasts 4 days the unluck of SuprNova was 172,48 : you earned about 2 times less than espected and on MiningPoolHub (average luck on the lasts 7 days with 555 blocks found : 96,64%).

Yes, you are very lucky to earn the same amount with SuprNova than MiningPoolHub in the last 4 days : the only possibility is to began mining just a little time before block 30,405 and stop mining just after :-).

[thefix]

Had my hash divided between a few pools when suprnova was doing better, now it seems some of the miners with a majority of hash power decided to move. I am moving everything back to suprnova to prevent one pool from dominating. Unfortunately some of those top miners have the equivalent of $50,000+ worth of hashing power, so if we can get even one of the top miners back over to suprnova things would balance out.

[ZenFr]

Had my hash divided between a few pools when suprnova was doing better, now it seems some of the miners with a majority of hash power decided to move. I am moving everything back to suprnova to prevent one pool from dominating. Unfortunately some of those top miners have the equivalent of $50,000+ worth of hashing power, so if we can get even one of the top miners back over to suprnova things would balance out.

I also pointed back all my workers to SuprNova : hope the unluck will change to luck ;-).

[CjMapope]

Sorry guys, i was being greedy, i am moving my hash back to supernova :/
i was there originally, but had some connection problems weeks ago and switched, moving a cpu farm takes time so i just left my hash where it was..
i hope we can level out the hash, i remember zcoins last fork when someone tried attacking it and the drama so we dont want that again!

[thefix]

Thanks for helping to keep the network more secure, hopefully we can keep the pools under 45% hash power.


Hopefully a few more will come over to keep things secure

[thefix]

We found a block pretty soon after, so it looks like our luck has changed and that extra hash power is making a difference!

[dasgardo87]

Thanks for your trust, you're right, the income is the same after time.

I've dropped the fee to 0% on suprnova in the hope that some folks might spread over some hash.

Yup Suprnova's pool is pretty stable and I believe they also now have an Asia Pacific node for our Chinese and Asian friends.

When is the MTP  released ? I'm waiting for that news as I know it will be released in early April but until now I can not see anything about this action.
I'm still waiting for this news soon and this fact will not make us down. I need a certain time for official MTP lauching. Thanks.

MTP has already been released on testnet as promised in early April so it's running on Zcoin testnet and people are free to test it on the zcoin mtp branch.

We don't have an official time for releasing on mainnet as we want to make sure it is relatively bug free and achieves the purpose we want but all we can say is 'soon'. It's hard to give definite date for bug fixing and dev but will update as we go along.

yes take your time sir, we dont want a buggy code destroy zcoin, in other hand what do you think about recent comment? is what they said is true (more easier to get attack when it's get centralized hash power)? if yes are you have any intention to do something to decentralize hashing power (maybe halving block time and halving block reward, or something) ? im sorry if sounds noob, tbh i am new miner here, but trully i wish a good thing happen to this coin

[thefix]

Thanks for your trust, you're right, the income is the same after time.

I've dropped the fee to 0% on suprnova in the hope that some folks might spread over some hash.

Yup Suprnova's pool is pretty stable and I believe they also now have an Asia Pacific node for our Chinese and Asian friends.

When is the MTP  released ? I'm waiting for that news as I know it will be released in early April but until now I can not see anything about this action.
I'm still waiting for this news soon and this fact will not make us down. I need a certain time for official MTP lauching. Thanks.

MTP has already been released on testnet as promised in early April so it's running on Zcoin testnet and people are free to test it on the zcoin mtp branch.

We don't have an official time for releasing on mainnet as we want to make sure it is relatively bug free and achieves the purpose we want but all we can say is 'soon'. It's hard to give definite date for bug fixing and dev but will update as we go along.

yes take your time sir, we dont want a buggy code destroy zcoin, in other hand what do you think about recent comment? is what they said is true (more easier to get attack when it's get centralized hash power)? if yes are you have any intention to do something to decentralize hashing power (maybe halving block time and halving block reward, or something) ? im sorry if sounds noob, tbh i am new miner here, but trully i wish a good thing happen to this coin

Miners have to make sure that they do not concentrate so much hash power on one pool, so it really falls on miner to be conscious and divide the hashing power they have. Making sure all miners have access to the fastest miner is also key to make sure that a concentration of hash power is not in the hands of a small group.

[ZenFr]

We found a block pretty soon after, so it looks like our luck has changed and that extra hash power is making a difference!

Yes but the block was with an (un)luck of 142,66 : 42.66% of our shares (mining power) losts !
And the block after (the last one found, just now) is with an (un)luck of 179,03 : 79,03 of our shares (mining power) lost !

And this is after a previous block with an unluck of more 500% !!!

Very very big unluck pool !

[ZenFr]

What is the point about XZC today ?

Technics
We are waiting for a very promising improvement (MTP) :-).
This is a all new improvement and it is probably risquy.

Mining
Mining is largely centralized on an unique pool and at any time a 51% attack can be done !
On the others pools, no more gains with a very high unluck score.

Exchanges/trading
For Bittrex (BTC38 has problems for withdrawing our BTC out of china).
The XZC value is stable since more one week, but there is a very big change : no more buyers wall, even at low price, and the order book is completely empty for the buyers side. The order book has only 25 btc for buyers and 725 btc for sellers (x29). And many sellers are at low price, with big volumes (more than 1800 XZC below 600,000 sats, and not mine).
Look at the graph "order book" : it is spectacular : many peoples want sell XZC but very few want buy XZC.

At any time the price may collapse.

Sorry but I stop mining on SuprNova (too much money lost) and I sold my XZC (too risquy with in one side a potential 51% attack and in the other side an order book completely empty for buyers).

I will be probably back when things will be better for XZC.
Cheers